Assigning Roles

By assigning a role to a user in a context, you
are granting them the permissions contained
in that role, for the current context and all
"lower" contexts.

Contexts:

System (the entire installation)

Front page (the "site course")

Course Categories

Course Sub-categories

Courses

Blocks and Activities

So for example, if you grant a Student role to a
user in a Course, they will have that role for
the course, but also all Blocks and Activities inside
that course. Their actual permissions may depend on
other roles and overrides that have been defined.